Re: DHCP or Probe?

["Clint Bodungen" <clint () secureconsulting com>]

 I'm getting the following traffic about every second to my cable modem (My
IP,
not a broadcast address.  UDP packets looking for port 67... but from a "10
dot"
address.  Is this the typical chatty Roadrunner DHCP probes or is it a worm
probe?
The reason I find this odd is because the source address here is from a "10
dot" class A.
I'm not on PTP... I have a public address... so this is either from a
spoofed address,
a misconfiguration by one of my cable modem neighbors, or worse... a
misconfiguration by RR.

Wed, 2004-03-10 14:43:33 - Device Receive UDP Packet -
Source:10.50.192.1,67,WAN - [Drop] Destination: [My IP Address]
Wed, 2004-03-10 14:43:33 - Device Receive UDP Packet -
Source:10.50.192.1,67,WAN - [Drop] Destination: [My IP Address]
Wed, 2004-03-10 14:43:35 - Device Receive UDP Packet -
Source:10.50.192.1,67,WAN - [Drop] Destination: [My IP Address]
Wed, 2004-03-10 14:43:35 - Device Receive UDP Packet -
Source:10.50.192.1,67,WAN - [Drop] Destination: [My IP Address]





---------------------------------------------------------------------------
Free 30-day trial: firewall with virus/spam protection, URL filtering, VPN,
wireless security

Protect your network against hackers, viruses, spam and other risks with Astaro
Security Linux, the comprehensive security solution that combines six
applications in one software solution for ease of use and lower total cost of
ownership.

Download your free trial at 
http://www.securityfocus.com/sponsor/Astaro_incidents_040301
----------------------------------------------------------------------------